Registry Lock

Registry Lock is the heavy-duty version of the ordinary transfer lock. Instead of a flag your registrar can flip in the control panel, it's a set of server-side statuses set by the registry itself, and removing them requires a manual process, usually a phone call and a passphrase, between the registrar and the registry.

The point is that a stolen registrar password isn't enough. A hijacker who gets into your account can't push, transfer, delete or change the nameservers on a locked domain, because the registrar can't do it either without the out-of-band step.

It costs real money, often a few hundred dollars a year per domain, and it's a hassle every time you legitimately want to change something. That's exactly why banks and big brands use it on their main domains, and why almost nobody uses it on the other five hundred names in a portfolio.